problem. I am not allowed to redirect the subdomain on the webserver:

gw.mydomain.com --> WAN-IP from IPFire

but must set an A-record in the DNA.

gw A [WAN-IP from IPfire]

now it works unencrypted. I will now get to the setup of LetsEncrypt. But for this I open a new threat.

many thanks!